Eavesdropping on the "ping-pong" quantum communication protocol 

Antoni Wójcik* 
Faculty of Physics, Adam Mickiewicz University, 
Umultowska 85, 61-614 Poznan, Poland 

Abstract 

The proposed eavesdropping scheme reveals that the quantum communication 
protocol recently presented by Bostr-^m and Felbinger [Phys. Rev. Lett. 89, 187902 (2002)] is 
not secure as far as quantum channel losses are taken into account. 

PACS numbers: 03.67.Hk, 03.65.Ud 

After the pioneering work of Bennett and Brassard published in 1984 [1] a variety of 
quantum secret communication protocols have been proposed (for a review see [2]). Although 
there are differences among particular protocols, almost all of them realize the following 
scenario. First, two strings of classical bits are generated by two legitimate users (Alice and 
Bob) in some procedure involving transmission through a quantum channel. Then, with the 
use of a públic channel (classical, unjammable channel), each bit string is divided into two 
parts - verification string and key. The públic statistical analysis of verification strings allows 
Alice and Bob to bound the amount of mutual information between them and a potential 
eavesdropper (Eve). If this amount of information is too high, the key has to be thrown away. 
In the other case the procedure of error correction and privacy amplification (also performed 
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with the use of públic channel) leads to the final key on which Eve's information is negligible. 
Let us emphasize here two properties of the above presented general scheme. First, both the 
verification string and the key are generated by essentially the same procedure. Secondly, this 
scheme ensures generation of a random key only. 

Recently, however, quite a different quantum cryptographic protocol has been 
proposed by Bostr-^m and Felbinger [3]. Their the so-called "ping-pong" protocol allows 
generation of a deterministic key or even direct secret communication. This improvement is 
obtained via random switching between two distinct communication modes - message mode 
and control mode. The key is generated in the message mode, while the eavesdropping is 
detected in the control mode. The only parameter which has to be analyzed in order to detect 
the eavesdropper is the correlation of bits generated in the control mode. The established key 
is believed to be insecure if and only if the results of measurements performed in the control 
mode coincide. The protocol have been claimed to be secure and experimentally feasible. 

The security of the "ping-pong" protocol can be, however, impaired as far as the 
realistic, not-negligible-distance implementations of this protocol are considered. Which 
protocol can be considered as practical and secure was specified by Brassard, Lytkenhaus, 
Mor and Sanders : "In order to be practical and secure, a quantum key distribution scheme 
must be based on existing - or nearly existing - technology, but its security must be 
guaranteed against an eavesdropper with unlimited computing power whose technology is 
limited only by the laws of quantum mechanics" [4]. The aim of our paper is to present an 
eavesdropping scheme which allows Eve to obtain some information about the key without 
any chance of being detected by a procedure proposed by Bostr-^m and Felbinger [3]. The 
scheme works provided that quantum channel losses are not too low, even if perfect photon 
sources and perfect detectors are used by Alice and Bob. The superiority of Eve over current 
technology is restricted to the possibility of near lossless photon transmission and 
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performance of two-photon CNOT gate on polarization qubits. Our scheme considers the 
opportunity of eavesdropping arising due to a separation of two procedures, namely the 
verification procedure and the key generation. Note that in the "ping-pong" protocol Eve 
knows which mode (control or message) was chosen by Alice at the time when she could still 
manipulate the travel photon. On the other hand, we ha ve to confés s that an attack can be 
easily detected if the traditional form of verification involving some subset of the key (e.g. 
QBER estimation) is performed. 

Let us start with the brief description of the "ping-pong" protocol of Bostr^-m and 
Felbinger [3] (see Fig. 1). Bob prepares two photons in entangled state 

|^ + ) = {0)|1) + |1)|0))/V2 of the polarization degree of freedom. He stores the first photon 

(home photon), and sends the second photon (travel photon) through a quantum channel to 
Alice. After receiving the travel photon Alice randomly switches between control mode and 
message mode. In the control mode Alice measures the polarization of the travel photon and 
announces the result in the públic channel. After receiving Alice' s result Bob also switches to 
the control mode, i.e. measures the state of the home photon in the same basis and compares 
results of both measurements, which should be perfectly anticorrelated in the absence of Eve. 
So, the appearance of identical results is considered to be the evidence of eavesdropping and 
if it occurs, the transmission is aborted. In the other case, the transmission goes on. In the 
message mode, on the other hand, Alice decides which valueje {0, l} she will transmit to 

Bob. She encodes this value with the use of the unitary operation Z J , where Z = |0)(0| , 

performed on the travel photon. The travel photon is then send back to Bob, who measures 
the state of both photons in the Bell basis. There are only two possible outcomes of this 



measurement, namely 
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measurement can be easily performed [5]. The above result allows Bob to decode the 
information send to him by Alice. \ x i í+ ) encodes j = 0,while \^~) encodes j = l. 

Eve, of course, has no accés s to the home photon but can manipulate the travel photon 
while it goes from Bob to Alice and back from Alice to Bob. It was proved by Bostr^-m and 
Felbinger [3] that the eavesdropping strategy which has zero probability of being detected, 
does not provide any information about the key to Eve. The proof, however, does not take 
into account the possible transmission losses. We will now present the effective 
eavesdropping strategy which never produces the identical results of the measurements 
performed by Bob and Alice in the control mode. The price which has to be paid by Eve is the 
creation of additional losses in the transmission from Bob to Alice. These losses can be used 
to detect eavesdropping in the case of ideal channel. On the other hand, in the realistic case of 
lossy channel, Eve can replace the original channel by a better one and hide the 
eavesdropping losses in the channel losses. 

The lossy quantum channel is described by a single-photon transmission efficiency T] . 
In order to explain the construction of our protocol, let us first consider the case of the ideal 
channel (r) = 1). Eve uses two auxiliary spatial modes x , y together with a single photon in 

the state |0) . She attacks the quantum channel twice, for the first time during the transmission 

from Bob to Alice (B-A attack) and for the second time during the transmission from Alice to 
Bob (A-B attack). The eavesdropping protocol (outlined in Fig. 2) starts with preparing two 
auxiliary modes x , y in the state | vac)JO) y , where | vac) denotes the empty mode. The state 

of the whole system is thus 

|initial) = |^) h Jvac)JO) y (1) 
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when the B-A attack takes place. This attack consist of performing unitary operation Q on 
three spatial modes t , x , y , where t denotes the travel photon mode. The operation Q 
defined as 

Q txy =SWAP tx CPBS txy H y (2) 

is composed of the Hadamard gate, SWAP gate and the three-mode gate which we call the 
controlled polarizing beam splitter (CPBS). The possible construction of CPBS (presented in 
Fig. 3) uses CNOT gates and a polarizing beam splitter which is assumed to transmit (reflect) 
photons in the state |0) (|l)). The CPBS, when acting on the relevant states, performs the 
following transformation 
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The B-A attack transforms the whole system to the state |B-A) = Q txy | v í í+ ) h | vac ) x |0) y of 
the form 

|B-A) = ||0)jvac)Jl)JO) y+ |l)Jl)Jvac)J + ||l)jvac)JO)Jl) y+ |0) t |0)Jvac) y ). (4) 

One sees that the operation Q first transforms the auxiliary photon to a superposition of the 
polarization states (jo) + |l))/V2 and then sends to Alice one element of this superposition 

conditionally on the state of the travel photon. The travel photon is stored by Eve. Suppose 
now that Alice switches to the control mode and measures the state of the mode t . Eq. 4 teli 
us that with a probability 1/2 Alice detects no photon. However, if the photon is detected, its 
state is perfectly anticorrelated with the state of the home photon. So, the probability of 
eavesdropping detection based on the correlation observation equals zero. (The eavesdropping 
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can be, however, still detected by the observation of the losses.) Let us now analyze the 
performance of the protocol in the case of Alice operating in the message mode. After Alice 
performs Z' t operation an A-B attack takes place. The A-B attack consist of performing an 

operation . After this attack the state of the system | A - B) = Q~' y Z' t | B - A) is 

l A - B > = ^(0> h |l) t |j> y + |l> h |0> t |0> y )|vac> x . (5) 

The final step of the eavesdropping protocol is a measurement of polarization performed on 
the y - photon. The result of this measurement will be denoted k , while the result of Bob's 

measurement will be denoted by m = (l) according to the I*?" 1 ") f^ - )) result. Let us rewrite 
Eq. 5 in a more convenient form 

Eq. 6 allows us to write the probabilities p jkm of possible measurement' s outputs for a given 
value of j . The only nonzero probabilities are 

Pooo=l/2 

PlOO = PlOl = Pno = Pm =V 8 

Assuming that Alice sends both vàlues of j with the same probability the mutual information 
between any two parties can be calculated. 

3 4 

l AE = I AB =T 1 Og2T = 0-311 

(8) 

I BE =l + -log 2 5-^log 2 3~0.074 

o Z 

One sees that mutual information between Eve and Alice equals to the mutual information 
between Bob and Alice. One can also see that the eavesdropping induces QBER (given by 

(Poki +Piko) ) at tne l eve l °f 1/4 • Note that the scheme is not symmetric in that sense that 

both the information obtained by Eve and the QBER depend on the value of the bit generated 



by Alice. Eve can remo ve this asymmetry by performing with probability of 1/2 the 
additional unitary operation S t just after the operation Q~^ y during the A-B attack. The 
operation S t is composed of Z , negation X and controlled negation CNOT, namely 

S ty =X t Z t CNOT ty X t . (9) 

(s) 

If the S t is performed the final state of the system | A - B) = S t y | A - B} is 

*~}J >J • 

The symmetrization procedure does not touch the QBER, however, it reduces the mutual 
information between Alice and Bob to the value 

I AB =^log 2 3-1 = 0.189. (11) 

So far, we have presented eavesdropping protocol which produces losses and errors 
but indeed does not produce the correlated results in the control mode. The losses induced by 
Eve can be, however, hidden in the channel losses. Suppose that Alice and Bob use a quantum 
channel of r] not exceeding 50%. Typical vàlues of T] for long-distance experimental 
quantum key distribution well fit this range [6 - 8]. Eve can replace the original quantum 
channel by a better one to double its transmission. If the transmission efficiency of Eve's 
channel is 2 r] then the total efficiency (taking into account both channel and eavesdropping 
losses) seen by Alice equals the efficiency of the original channel i.e. r] . On the other hand, 
the efficiency of the transmission Bob - Alice - Bob in the message mode should be r] 2 not 
4 T] 2 . So Eve has to filter out 75% of the photons reaching the Bob in the message mode. In 
this way the information about the eavesdropping is completely erased from the data 
generated in the control mode. If the efficiency of the original channel r] exceeds 50% , the 

undetectable eavesdropping is still possible, however, mutual information I AE cannot reach 



|a-bV sj = ^ 



h t 



h t 



j; y - 



h t 



+ 

' y 



7 



the value given in Eq. 10. In this case Eve has to replace the original channel by the ideal one 
and to eavesdrop only the fraction |l = 2(l-T|) of the transmitted bits. The vàlues of the 
mutual information I AE and I AB as functions of 77 are presented in Fig.4. It can be seen that 
the mutual information between Eve and Alice can exceeds the mutual information between 
Bob and Alice up to almost 60% transmission efficiency. 

Let us now consider how to improve of the "ping-pong" protocol to make it secure. 
This can be done, e.g., in a traditional way by sacrificing some part of the key in order to 
estimate QBER. Our scheme produces QBER equal to 25% which should be easily detected 
as the QBER measured in the long-distance quantum key distribution experiments [6-8] does 
not exceeds a level of a few percents. There is, however, another way to protect the "ping- 
pong" protocol against eavesdropping. Note that Eve's action depends on the actual Alice' s 
choice of the communication mode (control or message). If, e.g., she performs the A-B 
attack in the case of switching to the control mode by Alice it could happen that both Alice 
and Bob detect the photon in the travel mode. Such a "double" detection of the single travel 
photon can be used as an additional evidence of Eve's action. Thus, Alice has to delay the 
announcement of the information about a chosen mode. Bob, on the other hand, apart from 
measuring of the home photon' s polarization has also to check if there is any photon in the 
travel mode. In this way the detection of eavesdropping based on the analysis restricted to the 
control mode can be achieved. 

In conclusion we have presented undetectable eavesdropping scheme working on the 
realistic implementation of the "ping-pong" quantum communication protocol. The 
eavesdropping scheme works if the quantum channel losses cannot be ignored. It exploits the 
fact that the "ping-pong" protocol is performed with the use of two distinct modes (control 
and message mode), and moreover, that the information about which one of them is actually 
used is revealed too soon, i.e. in the time when Eve still has access to the travel photon. We 
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also suggest the way in which the original "ping-pong" protocol can be improved to fulfill the 
conditions of both practicality and security. 
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Fig. 1 The message mode and the control mode of the "ping-pong" protocol; h and t denote the 
home and the travel photon, respectively. 
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Fig. 2 Eavesdropping on the "ping-pong" protocol. 
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Fig. 3 Controlled polarization beam splitter (CPBS). The polarization beam splitter (PBS) 
transmits (reflects) photons in the state |0) (|l) ). 
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Fig. 4 Mutual information between Eve and Alice I AE and mutual information between Bob and 
Alice I AB as a function of quantum channel transmission efficiency T] . 
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